Yachtspotting: OSINT Methods in Navalny’s Corruption Investigation

Recently, Russian President Vladimir Putin’s press secretary, Dmitry Peskov, found himself embroiled in a scandal over his wristwatch, which was prominently displayed during his wedding to former Olympic ice dancer Tatiana Navka. Anti-corruption activist and Kremlin opponent Aleksey Navalny revealed that a watch worn by Peskov was worth upwards of $600,000, despite Peskov’s approximate annual salary of $147,000. On Monday, Navalny went a step further in his anti-corruption crusade against Putin’s press secretary.

Navalny received a tip from what he considers a reliable source that Peskov was renting out an expensive yacht well beyond his declared means for his honeymoon. According to this source (rumored to be socialite and television anchor Kseniya Sobchak), Peskov was spending his honeymoon with his wife, family, and close friends on this yacht, sailing to Sardinia, Naples, and Sicily.

By following the research methodology of Navalny and his online supporters, it becomes easier to follow this convoluted story of corruption and scandal. In this article, the OSINT methods of Aleksey Navalny’ and his team of investigators (collectively referred to as just “Navalny,” for the sake of simplicity) and various subsequent Russian-language investigations posted on social media will be detailed, along with their potential in unearthing corruption in other contexts.

Navalny’s OSINT research methodology

The methods of Navalny are accessible to anyone reading this article, except for the initial tip that Navalny received from a still-unrevealed source to initiate the research.

The yacht’s website

A large portion of the research on the Maltese Falcon could be found on, simply enough, the website for the Maltese Falcon (http://symaltesefalcon.com). The website provides rates for the yacht, a wealth of photographs of both the interior and exterior (for comparison with social media uploads), and the vessel’s exact specifications.

However, the “Tracking” function on the site provides very outdated information—the last report sent into the website places the vessel off the coast of Turkey on July 25, 2015.

VesselFinder.com

The Vessel Finder website operates much like Flight Aware or Flightradar24 in that it provides continual updates on the coordinates of various sea vessels, including cargo ships, fishing vessels, and, of course, yachts. By clicking the “Track” button on the Maltese Falcon’s entry on Vessel Finder, one can see the recent movements of the yacht across the Mediterranean.

Instagram

As anyone who has seen “Rich Kids of Instagram” can tell you, the 1% (or, 0.01%) love to show off what they have. This principle extends to the friends and families of wealthy bureaucrats and politicians. Navalny looked at the Instagram accounts of two people in particular: Peskov’s close friend Oleg Mitvol and Peskov’s step-daughter, Aleksandra.

Mitvol, as Navalny points out, has long been a close friend of Peskov. He has recently gained some fame as the photographer who captured the image of Peskov wearing the expensive watch that caused such a sensation. Mitvol posted a photograph of a yacht named “A,” owned by Andrey Melnichenko, Russia’s ninth richest man, and the yacht “Garcon.”

These photographs would not be notable if it were not for the fact that both of these yachts were at the same location as the yacht that Peskov supposedly rented out. Navalny proved this fact by studying the locations of the three yachts (“A,” “Maltese Falcon,” and “Garcon”) on Vessel Finder.

“A” and the Maltese Falcon were parked near one another on August 11, just off the coast of Capri:

On August 15, the Maltese Falcon and Garcon were next to one another. Shortly after each meeting, Mitvol posted photographs on Instagram of the yachts.

Navalny’s accusation with this detective work is that Mitvol was with Peskov at his wedding (as we know from the watch picture) and that he accompanied Peskov for his honeymoon escapade on the Maltese Falcon, where he twice photographed the yachts that were parked next to the yacht.

While Navalny’s investigations into the intersecting yachts and Mitvol is interesting, it is not nearly as damning as the photographs posted by his (new) step-daughter, Aleksandra. She posted a series of photographs during the week of Peskov’s honeymoon that have geotags for Sardinia:

However, geotags can be inaccurate or forged. Navalny digs deeper, noticing the words embroidered onto a bathrobe worn by Aleksandra as she is standing on what appears to be a sea vessel:

The letters “–ALTES- FALC—“ are visible—clearly indicating the name of the yacht she is currently on, the Maltese Falcon.

In sum, Navalny’s research shows that Peskov’s close friend Oleg Mitvol, who was recently at his wedding, and step-daughter were both on the Maltese Falcon yacht during the honeymoon. However, Peskov himself is nowhere to be found, and there is no direct proof in Navalny’s research that Peskov—with his relatively paltry salary—paid for the yacht’s exorbitant rent. Mitvol has told the Russian news outlet Yod that he and extremely wealthy Swiss lawyer Dmitry Yakubovsky were on the boat, and that Peskov was not. Mitvol did not account for the presence of Peskov’s family members on the boat with him and Yakubovsky, or why the 15-year old step-daughter of Peskov would apparently be sailing across the Mediterranean alone with two men thrice her age.

The public’s OSINT research methodology

Navalny did an admirable job in his OSINT research, but Russian-speakers on Twitter and elsewhere carried the research into new waters. They utilized many of the same methods as Navalny, but expanded their reach, not to mention some other innovative OSINT tools. 1

Gramfeed

Like Navalny, a small legion of Russian-speaking open source investigators and bloggers used Instagram to uncover evidence of the Maltese Falcon’s whereabouts and who was sailing it. Going further, public investigators used the service Gramfeed to search for photographs to geolocate the matching pictures from the Russian vacationers.

A photograph posted by Mitvol of a Sardinian cafe with the name“White” was easy to geolocate via Gramfeed, as the spot is quite photogenic:

As detailed in this tweet from Euromaidan Press staff writer @ReggaeMortis1, the Maltese Falcon passed into view for a webcam in the port of Palau on August 16. And, luckily for the investigators looking into the matter, the webcam shot was saved and accessible on the following day. With some quick geolocation work, the location of the Maltese Falcon is confirmed to correspond with a vessel visible in a webcam shot: A blogger under the alias @sgonch also found a publicly accessible webcam for the Hotel Cala di Volpe that captured the Maltese Falcon, leading to yet another geolocation of the yacht:

YouTube

While Navalny rightly noted the presence of Peskov’s step-daughter on the Maltese Falcon, he did not notice another passenger: Peskov’s biological daughter Liza Peskova. Liza posted a selfie four days before Navalny’s article—during the timespan that Peskov was on his honeymoon and supposedly renting the yacht—in an unidentified location. Georgy Alburov, an aide to Navalny, looked through Liza’s Instagram and discovered two selfies taken on a sea vessel within the last week that have geotags off the coasts of Capri and Sicily:

As seen at 7:57 in the below YouTube video, the same door (with identifiable markings) that is visible in Liza’s selfie also seem to be visible in a tour of the Maltese Falcon’s interior.

The geotag on the photo placed her near Capri—the same spot that the Maltese Falcon was at according to its travel logs.

This research from the public provided solid proof that Mitvol, Peskov’s step-daughter Aleksandra, and his biological daughter Liza were all on the Maltese Falcon, off the coast of Capri and Sardinia, in mid-August. While the combined research from Navalny and his supporters is interesting, it still does not prove Peskov’s physical presence on the yacht, or any outright lie from him, as he claims he is in Sicily with his bride. However, the story does not end here, and further OSINT research revealed more wrinkles in the story.

On August 17, Tatiana Navka, Peskov’s bride, posted a photograph on Instagram showing the newlywed couple at a hotel in Taormina, Siciliy, with a caption that seemingly addresses Navalny and his investigators: “Don’t look for a black cat in a dark room. Especially when it’s not there!” This refutation and apparent proof that Peskov and Navka are truly in a Sicilian hotel, as he claimed, only added more fuel to the fire.

Hair

This isn’t exactly a complex or reliable OSINT method; however, it is still worth noting for its originality. Navka’s Instagram image, showing the back of Peskov’s head while supposedly honeymooning in Sicily, caught the attention of Twitter user @Neiswestnij. As he noted, Peskov’s hair seems to have grown extremely fast over one week, as seen in comparing the hair length and shagginess from his wedding (top) and his honeymoon on week later (bottom):

Going a step further and delving into photographs of Peskov over the past year, the press secretary’s hair in June 2014 seems (again—this is far from an exact science) much shaggier and closer to the appearance of Navka’s recent photograph. The other twist in this theory is that the reason why the back of Peskov’s head, and not his face, was shown is because he shaved off his famous mustache in the summer of 2014, and it had regrown by over the past year. Thus, according to this logic, a frontal shot of Peskov would reveal that the picture is old.

Back to Instagram, the most useful tool in this OSINT research. Keen-eyed open source investigators looked back into Navka’s Instagram photographs to find that she had truly been at the Taormina, Sicily hotel—56 weeks ago. The implication of this is that the Instagram picture from Navka with Peskov could have been taken a year ago, not during their honeymoon.

The OSINT research of Navalny and his supporters demonstrate the full range of possibilities and limitations of open source research. On one hand, Navalny was not able to definitively prove that the yacht was rented by Peskov, and he could not be physically located on the yacht. On the other hand, the open source research shows that there are some uncertainties regarding his claim of being at a Sicilian hotel with his bride, and that his close friends and daughter/step-daughter are indeed cruising across the Mediterranean in one of the world’s most expensive yachts. Despite some still unresolved questions, the OSINT methodologies of Navalny and Russian-speaking investigators provide a master class in exposing corruption. As we see, the clearest route to proving that a bureaucrat is living outside of his or her means is not always by investigating the bureaucrat directly, but by friends and family members who cannot resist showing off their wealthy lifestyle. 2

Share this article:

Aric Toler started volunteering for Bellingcat in 2014 and has been on staff since 2015. He currently heads up Bellingcat's training efforts and its Eastern Europe/Eurasia research.

Join the Bellingcat Mailing List:

Enter your email address to receive a weekly digest of Bellingcat posts, links to open source research articles, and more.

Support Bellingcat

You can support the work of Bellingcat by donating through the below link:

7 Comments

What a tangled web.
Aric, I think yours and Navalny’s and his helper’s level of research might outclass some NSA agents.

Maybe not, I never had any experience there to be sure of that statement.
Still though, it is amazing the depth of research you can do, and then it just takes some careful analysis to do your checks and balances before you make a statement.
Those checks and balances are a large research project in themselves.

Kudos for the article and the exposure that vova’s right hand man who might have enjoyed some of the perks of that relationship, since vova has 22 different billion dollar dachas to rest his head and counting, why shouldn’t Peskov get his share of the laundered money for being a good lap dog.

The Russian Oligarchs are brazen. They don’t care, no court will convict them as they are the Untouchables. It’s like shooting fish in barrel documenting corruption. Entertaining in a way, but underneath is real misery and death of the Russian people. See http://russian-untouchables.com/eng/

When can we expect you to begin applying these methods to explain how American politicians leave office as newly minted multi-millionaires? I.e. the Clinton’s, coming soon the Obama’s, etc. Perhaps you can also look into the source of wealth of the Bush and Kennedy clans?

Or if this is all legitimate growth of wealth from fortunate cattle-futures trading, can we not be sure that Russian politicians are not also able to luckily increase their personal wealth by the same means?

And for that matter, how do we know the expensive watch, for example, is not simply a gift from a wealthy friend? Or that having your children run around on a wealthy friend’s yacht while you honeymoon in peace away from them is not also a wedding gift from a caring friend?